Revoking child agents

Revoking a parent grant must prevent future consequential actions by every child whose authority depends on that grant, including paused or remote agents.

01 / The operating case

What changes in a real workflow?

An incident commander cancels a remediation task while a child agent is queued to isolate a server.

Trace the authority boundary
  1. 01Origin grant
  2. 02Parent agent
  3. 03Narrow child grant
  4. 04Action boundary

02 / Decision contract

What the executor must check

Track ancestor references, broadcast revocation, invalidate cached decisions and recheck the chain when the child resumes.

InputPrincipal · task · action · target
DecisionGrant ancestry · policy · current state
ResultEnforce · record · verify outcome

Architecture review / negative test

Make the boundary testable.

Descendant invalidation follows grant ancestry, not a list of currently running processes. A paused child and a remote child may have valid credentials long after the parent task ends. Define whether revocation is synchronous at the executor or eventually propagated, and make the residual window visible to operators.

03 / Failure and evidence

What goes wrong, and what can be proven?

Failure mode

A child carries an unexpired credential and executes after the parent is cancelled.

Evidence to retain

Measure propagation lag and record denial or any in-flight effect that could not be stopped.

04 / Canonical scope

Why this reference stands alone

Authority revocation covers the general lifecycle; this page owns descendant traversal and resumed-task behavior.

Primary references

Read the underlying material

Architecture discussion

Choose one consequential action and make its boundary explicit.

Request a Conversation